Automate ISE endpoint export

[mike.ng.kl]

Hi ISE experts

Is there a way to schedule endpoint export to a csv file regularly on ISE? I can see the export button but would like to automate it. Cannot find anything about the related automation in ISE documentation. 

Thank you in advance. 

Cheers

Mike Ng

[Nadav]

One option is an ERS script. Check out:

https://hostname:9060/ers/sdk#Get-All

Just make sure ERS is enabled on your PAN and the user is in the ERS Admins group.

[mike.ng.kl]

Thank you for your reply but ERS API does not scale. It took 18 hours to dump 200K mac addresses with endpoint group information. The export button on GUI only took 15 mins. Is there a way to replicate the GUI export action? 

[pan · Accepted solution]

You can export the endpoint from CLI as well. What you can do is write some script which can login to ISE and run command "application configure ise".

ise-01/admin# application configure ise

Selection configuration option
[1]Reset M&T Session Database
[2]Rebuild M&T Unusable Indexes
[3]Purge M&T Operational Data
[4]Reset M&T Database
[5]Refresh Database Statistics
[6]Display Profiler Statistics
[7]Export Internal CA Store
[8]Import Internal CA Store
[9]Create Missing Config Indexes
[10]Create Missing M&T Indexes
[11]Enable/Disable ACS Migration
[12]Generate Daily KPM Stats
[13]Generate KPM Stats for last 8 Weeks
[14]Enable/Disable Counter Attribute Collection
[15]View Admin Users
[16]Get all Endpoints
[17]Enable/Disable Wifi Setup
[18]Reset Config Wifi Setup
[19]Establish Trust with controller
[0]Exit

Option 16 is what you have to select. File will be present in /localdisk and then you can export them using copy command.

[mike.ng.kl]

Thank you will test it out. 

[Nadav]

If ERS is really that much slower than using a local application call,
maybe it's worth opening a TAC case whether you go the REST route or not.

[mike.ng.kl]

It is apparently a design issue of ERS API. The get-all ERS call only dump the endpoint ID and MAC but not any details. To dump endpoint group and profile of each endpoint, it needs one get endpoint call per endpoint. So for 200K endpoints, the script needs to call the ERS API for 200K times - a definitely high number. If ERS can support get endpoint bulk call, it should resolve the issue - but unfortunately not. 

[Jason Kunst]

thanks i would recommend opening a tac case and getting a defect filed. I will also bring up with our PM for API. Please let us know the defect id

[paul]

I believe the other issue is the endpoints are only shown in increments of a 100.  So you have to constantly make further calls to parse through the Get-All process.  On my large install with 600k+ endpoints that is a non-starter.

[Parag Mahajan]

I have faced similar challenge for one of my customer. We have filed below defect.

CSCve05681 ERS Get-All takes very long time for response

CSCvg64354 ENH ISE ERS calls should be processed much faster

[Michael Burk]

Man this is a really great thread and saved alot of research. Would anyone be willing to share what their SSH script looked like? Thanks!

[elahtrebor]

I know this is a late answer but here is short script enumerating the ERS api using PERL and CURL to export all devices. (Attached)

Note must have CURL and set your ERS user, PW, and ISE host in the script. Dumps the JSON but can easily be parsed.

The script just calls a loop against the ERS api and looks for "nextPage" in the output.